Add Windows executable build and locked dependencies

README.md

@@ -69,6 +69,43 @@ use a Windows Python installation with Tk support, for example:
 uv run --python C:\Path\To\Python\python.exe soundtower --address YOUR_SPEAKER_MAC
 ```
 
+## Build a Windows executable
+
+Build using **Windows PowerShell and Windows Python**, not a Linux Python
+interpreter in WSL. [PyInstaller builds for the operating system it runs on](https://pyinstaller.org/en/stable/).
+
+```powershell
+git clone https://git.ldlda.com/lda/soundtower-controller.git
+cd soundtower-controller
+uv run --locked --python 3.14 --group bundle python scripts/build_exe.py
+```
+
+If you already cloned the repository, run `git pull --ff-only` there instead
+of cloning again. If uv's selected interpreter lacks Tcl/Tk, use a Windows
+Python installation with Tk via `--python C:\Path\To\Python\python.exe`.
+
+The application is created at:
+
+```text
+dist\SoundTowerController\SoundTowerController.exe
+```
+
+Double-click it and use Scan → choose speaker → Connect. Keep the **entire
+SoundTowerController folder**, including `_internal`, together when copying it
+to another computer. The recipient does not need uv or Python installed.
+
+For a single-file executable instead:
+
+```powershell
+uv run --locked --python 3.14 --group bundle python scripts/build_exe.py --onefile
+```
+
+That creates `dist\SoundTowerController.exe`; it extracts dependencies when
+launched. If startup fails, rebuild with `--console` to see the error. No code
+signing certificate is configured, so the build is an unsigned executable.
+The build script's arguments are tested; a real Windows executable build still
+requires validation on Windows.
+
 ## Controls
 
 - EQ: Party, Standard, Hip-hop, EDM, Rock, Latin, House, Reggae.
@@ -108,9 +145,10 @@ uv run --group dev ruff format --check controller tests scripts
 uv build
 ```
 
-The first online `uv run` resolves dependencies and creates `uv.lock`; commit
-that lockfile after resolving it for the project. A lockfile is not yet bundled
-because dependency resolution was unavailable in the offline development shell.
+The committed `uv.lock` pins runtime, development, and Windows build dependencies.
+Use `uv lock` when intentionally changing dependencies; the executable build
+examples use `--locked` so an out-of-date lockfile fails rather than changing
+silently.
 
 The tests use captured packet fixtures and fake transports; they do not need
 a speaker, Tk, or a display. They do not replace physical compatibility tests.
@@ -136,8 +174,9 @@ uv run --extra diagnostics python -m controller.probe --channel 1
 
 ## Preparing a repository
 
-This development folder also contains private research inputs. Export only the
-controller, tests, and original documentation into a **new, empty directory**:
+If working from a mixed firmware-research workspace, export only the controller,
+tests, and original documentation into a **new, empty directory**. A normal
+clone of this repository already contains only the publishable source:
 
 ```bash
 python scripts/export_project.py dist/soundtower-controller